Last night, the group was arguing again about whether this project is reliable or not.

I was advising on the sidelines, silently clicking open GitHub…
Honestly, beginners shouldn’t rush to look at how advanced the code is; first, check if there are “signs of activity”:
Are there recent commits? Are people seriously responding in issues? Is there a post-mortem after a problem occurs?
Not the kind that last updated half a year ago and still pretends to be calm.

Don’t treat the audit report as a talisman; focus on:
Is the audit the latest version? Have issues been fixed? After fixing, was there a recheck?
The worst are those who treat “Audit Passed” as a get-out-of-jail-free card;
dive into the details and you’ll see “low risk, not fixed (accepting the risk)”…
Yeah, you know whose risk is being accepted.

When it comes to upgrading multi-signature, I pay more attention to “who can act”:
Are the signers decentralized? Is there a timelock (giving you reaction time)?
Is the permission list so long you can’t see the end?
Recently, hardware wallets are out of stock, and phishing links are everywhere—don’t expect to outpace hackers with your reflexes…
Now, when I see “Click here to claim airdrop,” I just treat it as a drinking game:
Whoever clicks pays for the round.